From 6a53b89cb7fa9e74ec05e04654242e3368122d00 Mon Sep 17 00:00:00 2001 From: Deven Bansod Date: Mon, 3 Oct 2016 14:14:11 +0530 Subject: [PATCH] Escape database name properly to be used in MySQL wildcard statements Fix #12602 Signed-off-by: Deven Bansod --- libraries/server_privileges.lib.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libraries/server_privileges.lib.php b/libraries/server_privileges.lib.php index 932d7a3d13..d2a8c1ab1b 100644 --- a/libraries/server_privileges.lib.php +++ b/libraries/server_privileges.lib.php @@ -5153,7 +5153,9 @@ function PMA_addUserAndCreateDatabase($_error, $real_sql_query, $sql_query, // Grant all privileges on wildcard name (username\_%) $q = 'GRANT ALL PRIVILEGES ON ' . Util::backquote( - Util::sqlAddSlashes($username) . '\_%' + Util::escapeMysqlWildcards( + Util::sqlAddSlashes($username) + ) . '\_%' ) . '.* TO \'' . Util::sqlAddSlashes($username) . '\'@\'' . Util::sqlAddSlashes($hostname) . '\';';